Capture Still Images from Videos
Part of volume snapshot refinement.
A forensic license allows to sporadically capture still images from video files in JPEG format. This happens either in a user-defined interval (e.g. every 20 seconds) that can be dynamically based on the play length of the video, or you can opt for a fixed number of video stills per video (1-255), no matter the play length. While fixed-length intervals result in number of stills that grows proportionally with the play length, the fixed absolute number limits your workload if you are going to look at all stills in the gallery, and also decreases the time to process long videos, but of course at the cost of being less thorough and an increased risk of missing something should any suspect hide relevant content somewhere within an innocuous video. X-Ways Forensics tries to extract a fixed number of stills evenly from all over the video to give a representative impression of it.
This functionality is applied to files whose type matches the specified file mask series. Requires an external program (MPlayer), and requires that the volume is associated with the active case. Pictures can be extracted from all the video formats and codecs supported by MPlayer. Useful if you have to systematically check many videos for inappropriate, illegal, or otherwise relevant content (e.g. child pornography or terrorist training camp instructions). The use of intervals ensures that you won't miss notable parts that are hidden in the middle of a harmless vacation or birthday party video.
Extracting pictures considerably reduces the amount of data, and looking at stills in the gallery is much faster, efficient and more comfortable than having to watch all videos one after the other. The potentially time-consuming extraction process can be run unattended e.g. over night beforehand.
Also useful if you need to include extracted pictures in a printed report. The first extracted picture at the same time optionally can serve as a preview picture for the video file in Preview and Gallery mode. ASF/WMV videos protected with DRM cannot be processed and are consequentially marked with e! in the Attr. column. Note that you may hear occasional sound from the videos. Please turn off sound on your computer if you wish to avoid this. Note also that if you select a small interval (like smaller than 5 seconds), you may not necessarily get additional pictures. This depends on how the video was encoded/compressed. Duplicate stills are omitted when extracting pictures with MPlayer.
Once JPEG pictures have been exported from videos, the videos can optionally be dynamically represented in the gallery, with all extracted stills, showing them stills in a loop, to give a much more complete impression of the contents of videos without further user interaction (without having to explore them). Thus an alternative efficient way to review a large number of videos is this: Explore recursively, filter for videos, sort in descending order by number of child objects (so that videos with a similar number of stills are shown together), and activate Gallery mode. Watch the various video stills for each video. Proceed to the next gallery page when you are confident that no incriminating videos are represented on the current page, for example when all stills have been shown, which you will know is the case when the gallery has rotated back to the first still for each video.
A small amount of metadata is extracted from videos when exporting stills, usually coding/compression format, resolution, bits per pixel, frames per second, data rate per second for video data. That is in addition to the metadata that is provided by the regular metadata extraction.